Secure Boot Verification via Symbolic Links for Android Customization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise users need to unlock the bootloader of Android devices to customize features like disabling phone calls or modifying the camera, but conventional methods are not allowed by manufacturers due to security concerns, making it difficult to integrate custom firmware or software without compromising the integrity of the device.
Innovation Solution
Implementing a secure boot process that allows bootloader unlocking while maintaining the integrity of critical system files by using symbolic links and a protected file system to verify the integrity of specific files, ensuring that custom builds do not negatively impact security or network services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the bootloader is unlocked to allow customization, then adaptability is improved, but security and integrity of system files deteriorate
Solution Approach 1:
The patent divides the file system into protected and unprotected portions. Critical system files are placed in the protected portion with special markers, while user-customizable files are in the unprotected portion. This segmentation allows selective customization without compromising overall system integrity.
Solution Approach 2:
The patent introduces verification markers as intermediaries between the bootloader and system files. These markers (e.g., VERIFIED_FILE, UNVERIFIED_FILE) act as mediators that communicate file status to the bootloader, enabling the bootloader to make informed decisions about which files to verify and which to allow modification.
2Reliability
If all files are protected to maintain integrity, then reliability is improved, but ease of customization deteriorates
Solution Approach 1:
The patent applies different protection qualities to different parts of the file system. Protected files have verification markers and restricted access, while unprotected files have standard access permissions. This local differentiation allows users to customize specific components without affecting the integrity of critical system files.
3Reliability
If the bootloader remains locked to ensure security, then reliability is improved, but adaptability for enterprise customization deteriorates
Solution Approach 1:
The patent creates a dynamic system where the bootloader's verification behavior changes based on file markers. Instead of a static locked state, the bootloader dynamically adjusts its verification strictness based on the presence of verification markers in different file portions, enabling selective customization while maintaining security.
Data Source
AI summary
A method is provided for operating a computing device, the method including verifying the contents of a protected portion of a nonvolatile memory included in the computing device, the protected portion including a first protected file that includes first instructions; in response to the protected portion being successfully verified, initiating execution of an operating system kernel, on the computing device, included in a boot portion of the nonvolatile memory, wherein the boot portion is configured to cause the computing device to execute instructions stored in a system portion of the nonvolatile memory under control of the kernel, and the system portion is not included in the protected portion; subsequent to initiating execution of the kernel, locating the first instructions via a first symbolic link to the first protected file, wherein the first symbolic link is stored in one of the system portion or the boot portion; and executing the first instructions under control of the kernel.